Liem/java25 gradle9 migration

.github/workflows/ci-cd.yml

@@ -72,15 +72,13 @@ jobs:
           --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 12
     steps:
       - uses: actions/checkout@v4
-      - name: Set up JDK 11 (Corretto)
-        uses: actions/setup-java@v4    # cached + reliable; mirrors the Corretto 11 install-java.sh provisions
+      - name: Set up JDK 25 (Corretto)
+        uses: actions/setup-java@v4    # JDK 25 runs the Gradle 9 daemon; bytecode stays Java 11 via options.release
         with:
           distribution: corretto
-          java-version: '11'
-      - name: Set up Gradle 6.9.4
-        uses: gradle/actions/setup-gradle@v4
-        with:
-          gradle-version: '6.9.4'   # no wrapper in repo; legacy 'maven' plugin needs Gradle 6.x
+          java-version: '25'
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4   # version comes from the committed gradlew wrapper
       - name: Wait for ArangoDB + Redis
         run: |
           echo "Waiting for ArangoDB on :8529 ..."
@@ -101,10 +99,16 @@ jobs:
           if [ "$redis_ok" != "true" ]; then echo "Redis did not become reachable"; exit 1; fi
       - name: Build & unit tests
         working-directory: core-leo-cdp
-        run: gradle compileJava test
+        run: ./gradlew compileJava test
+      - name: Verify class-file target is Java 25 (major 69)
+        # Phase 4 / Wave 0 flipped the target to 25 (docs/06-java25-code-modernization-plan.md).
+        # Artifacts require a Java 25 runtime from here on.
+        working-directory: core-leo-cdp
+        run: |
+          javap -verbose -cp build/classes/java/main leotech.starter.MainHttpStarter | grep "major version: 69"
       - name: Code quality
         working-directory: core-leo-cdp
-        run: gradle check -x test
+        run: ./gradlew check -x test
       - name: Integration tests
         working-directory: core-leo-cdp
         env:

.gitignore

@@ -17,13 +17,10 @@ adsplay-report/public/ads/
 **.classpath
 **.log
 **.iml
-**/gradlew
-**/gradlew.bat
 
 docs/domain.txt
 core-leo-cdp/data-of-real-customer/
 core-leo-cdp/data-of-real-customer/*
-core-leo-cdp/gradle/*
 
 # CDP database configs must be excluded in commit 
 core-leo-cdp/configs/database-configs.json
@@ -41,4 +38,6 @@ airflow-ai-agent/.env
 
 
 # linux APT keys
-**.gpg
+**.gpg
+# Playwright MCP transient artifacts
+**/.playwright-mcp/

core-leo-cdp/.gitignore

@@ -30,6 +30,7 @@ build-target/*
 
 # Package Files #
 *.jar
+!gradle/wrapper/gradle-wrapper.jar
 *.war
 *.nar
 *.ear

core-leo-cdp/Dockerfile

@@ -4,14 +4,24 @@
 # iteration before the image boots cleanly.
 
 # ---- build stage ----
-FROM amazoncorretto:11 AS build
-RUN yum install -y unzip tar gzip && \
-    curl -sL https://services.gradle.org/distributions/gradle-6.9.4-bin.zip -o /tmp/g.zip && \
-    unzip -q /tmp/g.zip -d /opt && ln -s /opt/gradle-6.9.4/bin/gradle /usr/bin/gradle
+# JDK 25 runs the Gradle 9 daemon; bytecode target is pinned by options.release in
+# build.gradle (11 until migration Phase 4). The committed gradlew wrapper downloads
+# its own pinned Gradle distribution - no manual install needed.
+FROM amazoncorretto:25 AS build
+# findutils provides xargs, which the gradlew launcher script requires;
+# the minimal AL2023-based corretto image does not ship it.
+RUN yum install -y findutils
 WORKDIR /src
+# Wrapper files FIRST, then pre-fetch the Gradle distribution in its own retried
+# layer: the services.gradle.org download is flaky on some networks ("Premature
+# EOF"/timeouts). Ordered before COPY . . so the cached layer survives source
+# changes; it only invalidates when the wrapper itself is upgraded.
+COPY gradlew gradlew.bat ./
+COPY gradle/ gradle/
+RUN ./gradlew --version --no-daemon || ./gradlew --version --no-daemon || ./gradlew --version --no-daemon
 COPY . .
 # Output goes to /dist with deps/ alongside; JAR manifest Class-Path points to ./deps
-RUN gradle AutoBuildForDeployment --no-daemon \
+RUN ./gradlew AutoBuildForDeployment --no-daemon \
       -PbuildOutputFolderPath=/dist -PstaticOutputFolderPath=/static -PbuildVersion=docker
 
 # ---- test stage ----
@@ -20,7 +30,7 @@ RUN gradle AutoBuildForDeployment --no-daemon \
 # test.** classes need a live ArangoDB/Redis and won't pass inside an isolated build
 # (see CLAUDE.md). The workflow surfaces pass/fail from whatever reports are exported.
 FROM build AS test
-RUN gradle test --no-daemon \
+RUN ./gradlew test --no-daemon \
       -PbuildOutputFolderPath=/dist -PstaticOutputFolderPath=/static -PbuildVersion=docker || true
 RUN mkdir -p /test-results && \
     cp -r /src/build/test-results/. /test-results/ 2>/dev/null || true
@@ -32,9 +42,20 @@ FROM scratch AS test-export
 COPY --from=test /test-results /
 
 # ---- runtime stage ----
-FROM amazoncorretto:11
+FROM amazoncorretto:25
 WORKDIR /app
 COPY --from=build /dist /app
+# JDK-25 compat flags for old Netty (Vert.x 3) / Gson / JNI users - rationale in
+# docs/02-java-25-migration.md §3. JDK_JAVA_OPTIONS is read by the java launcher,
+# so the same flags apply if the ENTRYPOINT jar is overridden with another starter.
+ENV JDK_JAVA_OPTIONS="--sun-misc-unsafe-memory-access=allow \
+ --enable-native-access=ALL-UNNAMED \
+ --add-opens=java.base/java.lang=ALL-UNNAMED \
+ --add-opens=java.base/java.lang.reflect=ALL-UNNAMED \
+ --add-opens=java.base/java.util=ALL-UNNAMED \
+ --add-opens=java.base/java.nio=ALL-UNNAMED \
+ --add-opens=java.base/sun.nio.ch=ALL-UNNAMED \
+ -Dio.netty.tryReflectionSetAccessible=true"
 # 9070 = admin MainHttpRouter, 9080 = ObserverHttpRouter (see configs/http-routing-configs.json)
 EXPOSE 9070 9080
 ENTRYPOINT ["java", "-jar", "leo-main-starter-docker.jar"]